Method for defending against session hijacking attacks and firewall

Abstract

The present disclosure provides a method for defending against session hijacking attacks, including: receiving a first access request transmitted from a legal client side and transmitting the first access request to a server; receiving a first response comprising a first authentication token returned from the server; generating a first sequence value according to a network address of the legal client side and an identification code of the legal client side, and recombining the first authentication token and the first sequence value to form a second authentication token; and replacing the first authentication token in the first response with the second authentication token, and transmitting the first response comprising the second authentication token to the legal client side.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]This present application claims the benefit of Chinese Patent Application No. 201210579537.9 filed on Dec. 27, 2012; the contents of which are hereby incorporated by reference.BACKGROUND[0002]1. Technical Field[0003]The present disclosure relates to technologies of network telecommunications, and particularly, to a method for defending against session hijacking attacks and a firewall.[0004]2. Description of Related Art[0005]HTTP protocol is stateless and is not provided with a mechanism of connecting different kinds of requests / responses submitted by a user. Each of the requests / responses is an independent affair. In order to provide stateful HTTP, WEB applications need to dynamically interact with the user to maintain interaction state data between HTTP and a legal client side. The dynamic interaction process is called session. At first, the state data is transmitted to the legal client side for storage and then is returned for validati...

AI Technical Summary

Benefits of technology

This patent relates to a new method and firewall for protecting against session hijacking attacks. The main benefit is that it validates the identification of the client side, preventing illegal access to the server and providing a more comprehensive and reliable defense against session hijacking attacks. This also prevents false or missing reports, even if the token is changed.

Problems solved by technology

However, in practical application, an attacker may steal state information through a session hijacking loophole to achieve an illegal access by personating as other authenticated clients.

However, defenses based on characteristics are passive defenses which cannot defend against session hijackings beforehand and may cause false reports and missing reports easily.

On the other hand, defenses based on tokens have disadvantages including singularity and time dependency.

Additionally, if the firewall is configured to defend against one kind of the session hijacking attacks, the session still can be hijacked via other kinds of session hijacking attacks and the firewall still cannot defend against the new kind of session hijacking attack.

Images